SubRosaSoft is the developer of [[MacForensicsLab]] and several other [[OS X]] software titles including [[FileSalvage]], [[CopyCatX]], and [[VolumeWorks]]. Based in Union City, California. and founded in 2002 they specialize in privacy related and system utilities. Their design philosophy revolves around easy-to-use yet extremely powerful software. They have produced security, file and device management, home security, forensics, and data and device recovery. Their users range from entry-level Mac users and hobbyists to system administrators, consultants, and forensics professionals.

+

Interested in doing research in computer forensics? Looking for a master's topic, or just some ideas for a research paper? Here is my list. Please feel free to add your own ideas.

−

+

−

= Law Enforcement and Investigation Products =

+

==Disk Forensics==

+

===Stream Forensics===

+

Process the entire disk with one pass, or at most two, to minimize seek time.

Create a JPEG decompresser that supports restarts and checkpointing for use in high-speed carving.

−

The fastest software duplication system for Mac OS X. [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=7 CopyCatX] is extremely fast. It works on drives that other systems cannot recover by using our proprietary resumable/fault tolerant algorithms.

−

Backups include every single detail of the original including permissions, icons, placement, and content.

+

==Cell Phone Exploitation==

+

===Imaging===

+

Develop a tool for imaging the contents of a cell phone memory

+

===Interpretation===

+

* Develop a tool for reassembling information in a cell phone memory

−

Unlike most backup programs which copy file-by-file, [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=7 CopyCatX] utilizes a method called device copying. Device copying enables you to retain every detail of the original volume. It's a lot faster than the traditional method of backing up file-by-file. When duplicating a volume, [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=7 CopyCatX] is smart enough to skip all the blank space of a drive during the copying process to further improve the speed.

−

== VolumeWorks ==

+

==Corpora Development==

+

===Realistic Disk Corpora===

+

There is need for realistic corpora that can be freely redistributed but do not contain any confidential personally identifiable information (PII).

−

[http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=6 VolumeWorks] is an extremely powerful OS X software application for managing the partitions on your hard drive. VolumeWorks is designed to allow the end user the ability to:

+

These disk images may be either of an external drive or of a system boot drive. The drive images should have signs of ''wear'' --- that is, they should have resident files, deleted files, partially overwritten files, contiguous files, and fragmented files.

−

* Rebuild a partition table

+

===Realistic Network Traffic===

−

* Add partitions to a device

+

Generating realistic network traffic requires constructing a test network and either recording interactions within the network or with an external network.

−

* Hide partitions

+

−

* Shift partitions

+

−

* Resize partitions

+

−

+

−

= Free Products =

+

−

+

−

== DasBoot ==

+

−

+

−

[http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=193 DasBoot] Do you have a shiny new flash drive, or multi use storage device in your pocket ? Now you can turn it into a Mac OS X diagnostic, repair, and maintenance tool. DasBoot allows you to take any third party boot CD (such as those shipped by SubRosaSoft.com Inc, Prosoft Engineering Inc, Alsoft Inc, or Micromat Inc) and quickly create a bootable diagnostic device that contains any of your own utilities you may wish to install.

+

−

+

−

You can use your device to boot and repair Mac OS X computers* as needed without erasing it and taking away your ability to use it for other purposes such as playing music, or watching videos. With the help of DasBoot™ you get to carry all the tools you'll need with you. But unlike expensive third party alternatives, you'll have plenty of space left over in case you need to recover data.

+

−

+

−

DasBoot™ devices run software much faster than a CD/DVD repair disk. In addition you can re-configure the device at any time to add new utilities, updated versions of software or newer versions of Mac OS X.

+

−

+

−

== MusicRenamer ==

+

−

+

−

[http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=186 MusicRenamer] is Mac OS X software to quickly and easily rename large numbers of music files. [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=186 MusicRenamer] is a powerful mp3 file renaming tool. It helps to avoid spending hours of hard boring manual editing of mp3 filenames. You will rename your mp3 filenames easier and faster and...you'll see your mp3 list with consistent order in filenames. The renamer converts easily any rare and strange filename to a simple format containing the album name, track number, artist and title. You will be asked to select a folder that contains MP3, AAC, M4A, or M4P files. These files will be renamed based on the ID3 tags contained within them. If no ID3 tags are found the filename will be left unaltered.

+

−

+

−

== NetSpeedometer ==

+

−

+

−

[http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=56 NetSpeedometer] allows you to graphically monitor the speed of your internet connection. NetSpeedometer shows a graphic of your traffic speeds on your Apple Macintosh screen to help you keep track of data as it goes in and out of your machine. Free to download and distribute.

+

−

+

−

== Macnifier ==

+

−

+

−

[http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=56 NetSpeedometer] is Mac OS X software to expand part of your view for a closer look. [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=56 NetSpeedometer] shows a magnified section of your Apple Macintosh screen to help viewing up close. Free to download and distribute.

+

−

+

−

SubRosaSoft's [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=56 NetSpeedometer] displays a magnified portion of your screen in a separate window. Originally designed as a helper application to assist the visually impaired - it has become an ideal tool for Mac graphic design professionals who need pixel perfect placement and control.

+

−

+

−

It allows variable zooming, and variable speed refresh. This ability is helpful for the visually impaired and is almost essential for precision work in graphics design programs.

+

−

+

−

== ScreenBoard ==

+

−

+

−

[http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=11 Screenboard] allows the user to share their view with other users over the internet using [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=11 Screenboard] and the “Web Sharing” capability built into your Apple Macintosh Computer.

+

−

+

−

SubRosaSoft's [http://www.subrosasoft.com/OSXSoftware/index.php?main_page=product_info&cPath=200&products_id=11 Screenboard] lets others on your network watch your screen in a web browser. Ideal for labs, demonstrations, conferences, presentations, and any time you want to show others what you are doing.

+

−

+

−

You can select how often you want it and Screenboard will save a screenshot (in jpeg format) and a web page (in html format) to the folder of your choice. If you select to save the files into your built in personal web server folder - users on your network (or internet) can view your screen in their web browser.

Sanitization

Modify aimage so that it can take a partial disk image and a disk and just image what's missing.

Improve the data recovery features of aimage.

Replace AFF's current table-of-contents system with one based on B+ Trees.

Carving

JPEG Validator

Create a JPEG decompresser that supports restarts and checkpointing for use in high-speed carving.

Cell Phone Exploitation

Imaging

Develop a tool for imaging the contents of a cell phone memory

Interpretation

Develop a tool for reassembling information in a cell phone memory

Corpora Development

Realistic Disk Corpora

There is need for realistic corpora that can be freely redistributed but do not contain any confidential personally identifiable information (PII).

These disk images may be either of an external drive or of a system boot drive. The drive images should have signs of wear --- that is, they should have resident files, deleted files, partially overwritten files, contiguous files, and fragmented files.

Realistic Network Traffic

Generating realistic network traffic requires constructing a test network and either recording interactions within the network or with an external network.